---
name: implement-control-center
description: Implements the Verotel Control Center API for sales, transactions, refunds, and website reporting. Use when reading a sale, cancelling billing, refunding a transaction, or listing website activity.
title: Control Center
summary: Operational calls for sales and transactions. Send HTTP basic auth and Accept version 2.0.0 on every request.
slug: control-center
order: 7
---

# Implement Control Center

The Control Center API reads and changes sales, transactions, and websites for a merchant account. The product page is the source for paths and fields. If this skill and the product page disagree, follow the product page.

## Read first

1. [Control Center API](/en/control-center-api) for the calls, fields, and errors
2. [Control Center OpenAPI](/openapi/control-center-api.json) for the same calls as a specification

## Implement in this order

1. Create API credentials on the Control Center "Setup Control Center API" page. Keep the username and password on the server.
2. Send `Authorization: Basic` with those credentials, and `Accept: application/json; version=2.0.0`, on every request.
3. Use the host `https://controlcenter.verotel.com/api`.
4. Read a sale or transaction before you cancel, downgrade, extend, terminate, or refund it.
5. Honor `429` and `Retry-After`. The limit is 500 requests per hour, shared by every API user on the account.

## Credentials

- Control Center API username and password from the setup page.
- The documented `Authorization` example is not a credential. Use the merchant's own username and password.

## Traps

- A missing or wrong `version=2.0.0` on `Accept` returns 406. The version is all three numbers.
- Unknown objects return 404. A sale that is already cancelled, and other application errors, return 412.
- `X-RateLimit-Remaining` is the requests left in the current hour. A `429` means stop until `Retry-After`.
- Paths and fields change with the reference. Read the operation before writing the client.

## Done when

A basic-auth request with `Accept: application/json; version=2.0.0` returns the sale or transaction you asked for, and a `401`, `406`, `412`, or `429` is handled without retrying a permanent error.